This article is published in English.
Practical notes: “MCP: Protocol That Turns AI From a Chatbot Into an AI Agent
Operable walkthrough of Practical notes: “MCP: Protocol That Turns AI From a Chatbot Into an AI Agent”: contracts, checks, and drop-in code slots for teams shipping mcp systems.
The following notes reconstruct a practical path around ““MCP: Protocol That Turns AI From a Chatbot Into an AI Agent””. Emphasis stays on contracts, checks, and drop-in code placeholders rather than motivational framing. When working through Overview, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
1. The Problem Before MCP
- The Problem Before MCP works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
AI Application
├── GitHub Integration
├── Slack Integration
├── Jira Integration
├── Database Integration
├── File Integration
└── Internal API Integration
2. Why MCP Was Needed
- Why MCP Was Needed works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
3. What Is MCP?
- What Is MCP? works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
- What Is MCP? works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
User
↓
AI Application / Host
├── LLM
└── MCP Client
↓
MCP Server
↓
External System
4. A Simple MCP Example
For 4. A Simple MCP Example, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
GitHub
PostgreSQL
Jira
Documentation
Local Files
AI App → Custom GitHub Code
AI App → Custom DB Code
AI App → Custom Jira Code
AI App → Custom File Code
AI Developer Assistant
│
MCP Client
│
┌──────────────┼──────────────┐
▼ ▼ ▼
GitHub MCP Database MCP Jira MCP
│ │ │
▼ ▼ ▼
GitHub PostgreSQL Jira
5. MCP Architecture
For 5. MCP Architecture, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
MCP Host
For MCP Host, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary. For MCP Host, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
MCP Client
When working through MCP Client, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
MCP Server
When working through MCP Server, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
Model / LLM
When working through Model / LLM, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Cache stable system instructions and tool schemas. Re-sending identical preamble is a common source of burn. When working through Model / LLM, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
Host
├── LLM
└── MCP Client
│
├── MCP Server → GitHub
├── MCP Server → Database
└── MCP Server → Jira
6. Tools, Resources and Prompts
- Tools, Resources and Prompts works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Budget tokens per turn and per session. Agentic tools expand context aggressively; hard caps keep demos from becoming surprise invoices.
Tools — “Let the AI perform an action”
Tools — “Let the AI perform an action” works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
create_issue()
get_issue()
search_repositories()
create_pull_request()
Resources — “Give the AI information”
Resources — “Give the AI information” works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve. Resources — “Give the AI information” works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
file:///project/README.md
database://customers/123
github://repository/issues
docs://api/authentication
Prompts — “Give the AI a predefined workflow or set of instructions”
For Prompts — “Give the AI a predefined workflow or set of instructions”, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
Review the following pull request.
Check:
1. Code quality
2. Security vulnerabilities
3. Performance
4. Error handling
5. Test coverage
Provide:
- Summary
- Problems
- Recommendations
7. How MCP Works
For 7. How MCP Works, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
get_sales_data(date)
User
↓
AI Application
↓
LLM determines that external data is required
↓
MCP Client
↓
MCP Server
↓
Sales Database
↓
MCP Server
↓
MCP Client
↓
LLM
↓
Final Answer
Today's sales = ₹15,000
8. MCP and Function Calling Are Not the Same
For 8. MCP and Function Calling Are Not the Same, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary. For 8. MCP and Function Calling Are Not the Same, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
Function Calling
Model
↓
Application
↓
Function
↓
Result
↓
Model
MCP
AI Host → MCP Client → MCP Server → External System
9. MCP vs REST APIs and SDKs
When working through 9. MCP vs REST APIs and SDKs, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
AI
↓
MCP
↓
REST API / SDK
↓
Backend
10. MCP for AI Agents
When working through 10. MCP for AI Agents, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
Question → Answer
Understand task
↓
Select tool
↓
Call tool
↓
Inspect result
↓
Call another tool
↓
Complete task
1. Search deployment logs
2. Inspect GitHub changes
3. Check Kubernetes status
4. Search documentation
5. Create a Jira ticket
11. MCP + RAG
When working through 11. MCP + RAG, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Measure recall on a fixed question set before tuning prompts. Prompt churn rarely fixes a weak retrieval surface. When working through 11. MCP + RAG, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
Documents
↓
Embedding
↓
Vector Database
↓
Retriever
↓
Relevant Context
↓
LLM
AI Application
↓
MCP Client
↓
Knowledge MCP Server
↓
Vector DB / Search / Documents
search_documentation()
get_document()
find_related_documents()
12. MCP in LLMOps
- MCP in LLMOps works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Budget tokens per turn and per session. Agentic tools expand context aggressively; hard caps keep demos from becoming surprise invoices.
MCP Server Lifecycle
Tool Versioning
Security
Monitoring
Logging
Testing
Reliability
Access Control
Performance
User
↓
AI Application
↓
Model
↓
Agent
↓
MCP Client
↓
MCP Server
↓
External System
13. MCP Security
- MCP Security works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
Read private files
Query databases
Create tickets
Send emails
Modify infrastructure
Access repositories
Authentication
Authentication works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve. Authentication works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
Authorization
For Authorization, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
Least Privilege
For Least Privilege, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
Input Validation
For Input Validation, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary. For Input Validation, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
Output Validation
When working through Output Validation, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
Secret Management
When working through Secret Management, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
Audit Logging
When working through Audit Logging, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours. When working through Audit Logging, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
User / Identity
Tool Invoked
Timestamp
Arguments or Sanitized Arguments
Result / Status
Authorization Decision
Execution Duration
14. Prompt Injection and Tool Abuse
- Prompt Injection and Tool Abuse works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Budget tokens per turn and per session. Agentic tools expand context aggressively; hard caps keep demos from becoming surprise invoices.
Model decides action
↓
Policy validation
↓
Authorization
↓
Tool execution
15. MCP in Enterprise AI
- MCP in Enterprise AI works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
Enterprise AI Platform
│
MCP Gateway
│
┌──────┼─────────┐
▼ ▼ ▼
GitHub Data Operations
MCP MCP MCP
Identity
Authorization
Tenant Isolation
Audit
Monitoring
Tool Ownership
Versioning
Compliance
16. MCP + Microservices + Cloud
- MCP + Microservices + Cloud works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
- MCP + Microservices + Cloud works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
AI Application
↓
MCP Server
↓
Internal API
↓
Microservice
↓
Database
17. MCP Design Patterns
For 17. MCP Design Patterns, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
Single MCP Server
For Single MCP Server, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
AI Application
↓
MCP Server
┌────┼────┐
↓ ↓ ↓
Files GitHub Database
Multiple Domain Servers
For Multiple Domain Servers, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary. For Multiple Domain Servers, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
AI Application
│
├── Engineering MCP
│ └── GitHub / CI-CD
│
├── Data MCP
│ └── Databases / Analytics
│
└── Operations MCP
└── Monitoring / Cloud / Infrastructure
Read/Write Separation
When working through Read/Write Separation, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
Read MCP
├── Search Documentation
├── Read Logs
└── Query Metrics
Write MCP
├── Create Ticket
├── Restart Service
└── Modify Resource
Central MCP Gateway
When working through Central MCP Gateway, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours.
AI Applications
│
▼
MCP Gateway
┌──────────┼──────────┐
↓ ↓ ↓
Engineering Data Operations
MCP MCP MCP
18. MCP Performance and Observability
When working through 18. MCP Performance and Observability, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Log tool name, args hash, latency, and outcome for every call. Debugging agent loops without that trail wastes hours. When working through 18. MCP Performance and Observability, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
Tool Latency
Tool Success Rate
Tool Errors
Timeouts
Invocation Counts
Backend Latency
Request Volume
Token / Cost Impact
User Request
↓
LLM
↓
Tool Selection
↓
MCP Request
↓
Backend
↓
Tool Result
↓
LLM
↓
Final Response
19. When Should You Use MCP?
- When Should You Use MCP? works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
Multiple AI applications
+
Many external systems
+
Reusable capabilities
+
Tool discovery
+
Agentic workflows
20. MCP for Production AI Architecture
- MCP for Production AI Architecture works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
User
│
▼
┌────────────────┐
│ AI Application│
└───────┬────────┘
│
┌───────▼────────┐
│ Agent / LLM │
└───────┬────────┘
│
┌───────────┼───────────┐
▼ ▼ ▼
RAG Policies Memory
│ │
└───────────┼───────────┘
▼
MCP Client
│
┌─────────────┼─────────────┐
▼ ▼ ▼
GitHub MCP Database MCP Ops MCP
│ │ │
▼ ▼ ▼
GitHub Database Cloud/K8s
Security
Observability
Governance
Versioning
Testing
LLMOps
Conclusion: MCP Is About More Than Tool Calling
Conclusion: MCP Is About More Than Tool Calling works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve. Conclusion: MCP Is About More Than Tool Calling works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph.
LLM
↓
LLM + Tools
↓
LLM + RAG
↓
AI Agents
↓
Agents + Many External Systems
↓
Standardized Capability Layer
↓
Production AI Platform
Operational checklist
For Operational checklist, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state.
Record timings and token or query cost next to functional results. Cost visibility early prevents surprise bills when the path moves from demo to shared environments.
Authenticate at the gateway and re-authorize at the data plane. A bearer token alone is not a tenancy boundary.
Checkpoint after expensive steps. Resume should not re-bill the same LLM call when an operator retries a later node.
Pin dependency versions and record the image digest that ran the demo. Reproducibility beats tribal knowledge.
Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline.
Before promoting the stack, freeze versions, capture a golden transcript for the critical path, and confirm rollback steps. Shared environments need rate limits, tenancy checks, and a clear owner for secret rotation. Prefer boring reliability over clever one-off demos.
Batch note for b64f5bd5ee1d: keep provider keys out of the repo, set a per-session token ceiling, and store transcripts next to the eval fixtures so later model swaps stay comparable.